[java-idp-plugin-webauthn] branch main updated: Improve logging and log levels
Phil Smart
philip.smart at jisc.ac.uk
Thu Dec 5 10:51:49 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=304a15f902a7c1aca4880d8e8aa88a1d229abfff
The following commit(s) were added to refs/heads/main by this push:
new 304a15f Improve logging and log levels
304a15f is described below
commit 304a15f902a7c1aca4880d8e8aa88a1d229abfff
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Dec 5 10:51:47 2024 +0000
Improve logging and log levels
---
.../admin/impl/AddAttestationConveyancePreference.java | 2 +-
.../admin/impl/AddAuthenticatorAttachmentRequirement.java | 2 +-
.../plugin/authn/webauthn/admin/impl/AddDisplayName.java | 2 +-
.../webauthn/admin/impl/AddResidentKeyRequirement.java | 2 +-
.../idp/plugin/authn/webauthn/admin/impl/AddUserId.java | 13 ++++++++-----
.../idp/plugin/authn/webauthn/admin/impl/AddUserName.java | 2 +-
.../webauthn/admin/impl/DeletePublicKeyCredential.java | 4 ++--
...xtractPublicKeyCredentialAttestationFromFormRequest.java | 5 +++--
.../authn/webauthn/admin/impl/StorePublicKeyCredential.java | 2 +-
.../impl/ValidateAuthenticatorAttestationResponse.java | 2 +-
.../client/impl/YubicoWebAuthnAuthenticationClient.java | 10 ++++++++--
.../authn/webauthn/impl/AddUserVerificationRequirement.java | 2 +-
.../plugin/authn/webauthn/impl/GenerateServerChallenge.java | 5 ++++-
13 files changed, 33 insertions(+), 20 deletions(-)
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAttestationConveyancePreference.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAttestationConveyancePreference.java
index 97d6d4c..27f301a 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAttestationConveyancePreference.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAttestationConveyancePreference.java
@@ -96,7 +96,7 @@ public class AddAttestationConveyancePreference extends AbstractWebAuthnAction<W
final AttestationConveyancePreference preference =
attestationConveyancePreferenceLookupStrategy.apply(profileRequestContext);
- log.trace("{} Attestation conveyance preference is '{}'",getLogPrefix(), preference);
+ log.debug("{} Attestation conveyance preference is '{}'",getLogPrefix(), preference);
context.setAttestationConveyancePreference(preference);
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAuthenticatorAttachmentRequirement.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAuthenticatorAttachmentRequirement.java
index 410f5e1..b8e16b3 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAuthenticatorAttachmentRequirement.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAuthenticatorAttachmentRequirement.java
@@ -98,7 +98,7 @@ public class AddAuthenticatorAttachmentRequirement extends AbstractWebAuthnActio
final AuthenticatorAttachment attachment =
authenticatorAttachmentRequirementLookupStrategy.apply(profileRequestContext);
- log.trace("{} AuthenticatorAttachment is '{}'",getLogPrefix(),
+ log.debug("{} AuthenticatorAttachment is '{}'",getLogPrefix(),
attachment != null ? attachment : "ANY");
context.setAuthenticatorAttachmentRequirement(attachment);
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddDisplayName.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddDisplayName.java
index 8aeabd6..f14ac48 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddDisplayName.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddDisplayName.java
@@ -111,7 +111,7 @@ public class AddDisplayName extends AbstractWebAuthnAction<WebAuthnRegistrationC
if (displayName.getBytes(StandardCharsets.UTF_8).length > 64) {
log.trace("{} DisplayName exceeds 64 bytes and might get truncated by the authenticator", getLogPrefix());
}
- log.trace("{} Populating DisplayName '{}'",getLogPrefix(),displayName);
+ log.debug("{} Populating DisplayName '{}'",getLogPrefix(),displayName);
context.setDisplayName(displayName);
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddResidentKeyRequirement.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddResidentKeyRequirement.java
index 22514e4..3a79e1f 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddResidentKeyRequirement.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddResidentKeyRequirement.java
@@ -90,7 +90,7 @@ public class AddResidentKeyRequirement extends AbstractWebAuthnAction<WebAuthnRe
protected void doExecute(final ProfileRequestContext profileRequestContext,
final WebAuthnRegistrationContext context) {
final ResidentKeyRequirement requirement = residentKeyRequirementLookupStrategy.apply(profileRequestContext);
- log.trace("{} ResidentKey requirement is '{}'",getLogPrefix(), requirement);
+ log.debug("{} ResidentKey requirement is '{}'",getLogPrefix(), requirement);
context.setResidentKeyRequirement(requirement);
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserId.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserId.java
index eb476dc..8f71b05 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserId.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserId.java
@@ -127,7 +127,10 @@ public class AddUserId extends AbstractWebAuthnAction<WebAuthnRegistrationContex
if (existingUserHandle.isPresent()) {
final byte[] handleAsBytes = existingUserHandle.get().getBytes();
assert handleAsBytes != null;
- log.trace("{} Found user.id '{}'",getLogPrefix(),handleAsBytes);
+ if (log.isDebugEnabled()) {
+ log.debug("{} Found existing user.id '{}'",getLogPrefix(),
+ WebAuthnSupport.toBase64OrUnknown(handleAsBytes));
+ }
context.setUserId(handleAsBytes);
return;
}
@@ -135,17 +138,17 @@ public class AddUserId extends AbstractWebAuthnAction<WebAuthnRegistrationContex
// else we build a user.id from the generator function
final byte[] userId = userIdGeneratorStrategy.apply(profileRequestContext);
if (userId == null || userId.length == 0) {
- log.trace("{} Generated user.id was empty or null", getLogPrefix());
+ log.warn("{} Generated user.id was empty or null", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
return;
}
if (userId.length > 64) {
- log.trace("{} User.id is larger than 64 bytes", getLogPrefix());
+ log.warn("{} User.id is larger than 64 bytes", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
return;
}
- if (log.isTraceEnabled()) {
- log.trace("{} Generated user.id '{}' of size '{}'",getLogPrefix(),WebAuthnSupport.toBase64OrUnknown(userId)
+ if (log.isDebugEnabled()) {
+ log.debug("{} Generated user.id '{}' of size '{}'",getLogPrefix(),WebAuthnSupport.toBase64OrUnknown(userId)
, userId.length);
}
context.setUserId(userId);
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserName.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserName.java
index 3c90b1e..dc75794 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserName.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserName.java
@@ -118,7 +118,7 @@ public class AddUserName extends AbstractWebAuthnAction<WebAuthnRegistrationCont
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
return;
}
- log.trace("{} Populating User.name '{}' for user '{}'",getLogPrefix(),webAuthnUserName, username);
+ log.debug("{} Populating User.name '{}' for user '{}'",getLogPrefix(),webAuthnUserName, username);
context.setName(webAuthnUserName);
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/DeletePublicKeyCredential.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/DeletePublicKeyCredential.java
index e60a8e5..1c9db58 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/DeletePublicKeyCredential.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/DeletePublicKeyCredential.java
@@ -99,8 +99,8 @@ public class DeletePublicKeyCredential extends AbstractWebAuthnAuditingAction<We
}
} else {
final boolean removed = repository.removeRegistrationByUsername(username, credential.get());
- log.debug("{} Credential '{}' {} removed", getLogPrefix(), credential.get().getCredentialIdBase64(),
- removed ? "was" : "was not");
+ log.info("{} Credential '{}' {} removed for user '{}'", getLogPrefix(),
+ credential.get().getCredentialIdBase64(), removed ? "was" : "was not", username);
if(removed) {
auditSuccess(profileRequestContext, "credential-removed");
} else {
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractPublicKeyCredentialAttestationFromFormRequest.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractPublicKeyCredentialAttestationFromFormRequest.java
index b393eb9..7dbc165 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractPublicKeyCredentialAttestationFromFormRequest.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractPublicKeyCredentialAttestationFromFormRequest.java
@@ -113,10 +113,11 @@ public class ExtractPublicKeyCredentialAttestationFromFormRequest
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
- log.trace("PublicKeyCredential authenticator attestation response:'{}'",pkCredAttestationJson);
+ log.trace("{} PublicKeyCredential authenticator attestation response:'{}'",getLogPrefix(),
+ pkCredAttestationJson);
final String credNickname = request.getParameter(credentialNicknameParameterName);
- log.trace("Credential nickname is '{}'",credNickname);
+ log.trace("{} Credential nickname is '{}'",getLogPrefix(), credNickname);
if (StringSupport.trimOrNull(credNickname) == null) {
log.debug("{} No credential nickname in request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java
index 3304b1d..132e075 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java
@@ -181,7 +181,7 @@ public class StorePublicKeyCredential extends AbstractWebAuthnAuditingAction<Web
log.info("{} Added public key credential registration for user '{}' with user.id '{}' and key '{}'. "
+ "Using a discoverable credential '{}' and user verification '{}'",
- getLogPrefix(), username, userIdBase64, registrationResult.getKeyId().getId().getBase64Url(),
+ getLogPrefix(), username, userIdBase64, registrationResult.getKeyId().getId().getBase64(),
registrationResult.isDiscoverable().isPresent() ? registrationResult.isDiscoverable() :
"unknown", registrationResult.isUserVerified());
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ValidateAuthenticatorAttestationResponse.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ValidateAuthenticatorAttestationResponse.java
index 2668598..8d1afe7 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ValidateAuthenticatorAttestationResponse.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ValidateAuthenticatorAttestationResponse.java
@@ -106,7 +106,7 @@ public class ValidateAuthenticatorAttestationResponse extends AbstractWebAuthnAc
// been validated.
final ByteArray aaguid = credentialPublicKey.getAaguid();
final String athenticator = aaguid != null ?new AAGUID(aaguid).asGuidString() : "unknown";
- log.debug("{} Was attestation for authenticator '{}' trusted? {}", getLogPrefix(),
+ log.trace("{} Was attestation statement for authenticator '{}' trusted? {}", getLogPrefix(),
athenticator, credentialPublicKey.isAttestationTrusted() ? "Yes" : "No");
// If valid. Add back to context
context.setRegistrationResult(credentialPublicKey);
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java
index 6d8dcde..3fcfcbf 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java
@@ -167,8 +167,13 @@ public class YubicoWebAuthnAuthenticationClient implements WebAuthnAuthenticatio
if (log.isDebugEnabled()) {
if (username == null && userId == null) {
+ final Optional<ByteArray> userHandleOptional =
+ authenticatorAssertionResponse.getResponse().getUserHandle();
+ final ByteArray userHandle = userHandleOptional.isPresent() ? userHandleOptional.get() : null;
+ final String userHandleBase64 =
+ userHandle != null ? WebAuthnSupport.toBase64OrUnknown(userHandle.getBytes()) : "unknown";
log.debug("Attempting validation of assumed discoverable credential with userHandle from response "
- + "'{}'", authenticatorAssertionResponse.getResponse().getUserHandle());
+ + "'{}'", userHandleBase64);
} else {
log.debug("Attempting validation of credential with username '{}' and userHandle '{}'",
username, WebAuthnSupport.toBase64OrUnknown(userId));
@@ -209,7 +214,8 @@ public class YubicoWebAuthnAuthenticationClient implements WebAuthnAuthenticatio
authenticatorAttestationResponse) throws RegistrationFailureException {
try {
- log.trace("Public Key Credential to validate '{}'", authenticatorAttestationResponse);
+ log.debug("Attempting validation of public key credential attestation '{}'",
+ authenticatorAttestationResponse);
final com.yubico.webauthn.RegistrationResult result =
rp.finishRegistration(FinishRegistrationOptions.builder()
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/AddUserVerificationRequirement.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/AddUserVerificationRequirement.java
index ca1cd3c..731d212 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/AddUserVerificationRequirement.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/AddUserVerificationRequirement.java
@@ -77,7 +77,7 @@ public class AddUserVerificationRequirement extends AbstractWebAuthnAction<BaseW
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final BaseWebAuthnContext context) {
- log.trace("{} UserVerification is '{}'",getLogPrefix(), userVerificationRequirement);
+ log.debug("{} UserVerification is '{}'",getLogPrefix(), userVerificationRequirement);
context.setUserVerificationRequirement(userVerificationRequirement);
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/GenerateServerChallenge.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/GenerateServerChallenge.java
index 3158880..99b73da 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/GenerateServerChallenge.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/GenerateServerChallenge.java
@@ -95,7 +95,10 @@ public class GenerateServerChallenge extends AbstractWebAuthnAction<BaseWebAuthn
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return;
}
- log.trace("{} Generated server challenge {} of size '{} bytes'",getLogPrefix() ,challenge, challenge.length);
+ if (log.isDebugEnabled()) {
+ log.debug("{} Generated server challenge {} of size '{} bytes'",getLogPrefix() ,
+ WebAuthnSupport.toBase64OrUnknown(challenge), challenge.length);
+ }
context.setServerChallenge(challenge);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list